Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace versions 2025.1.2 and prior contain a Direct Request ('Forced Browsing') vulnerability (CVE-2025-26381) with CVSS v3.1 score of 9.3. The vulnerability allows attackers to gain unauthorized access to sensitive information through remote exploitation with low attack complexity. Affects critical infrastructure sectors including commercial facilities, manufacturing, energy, government services, and transportation systems worldwide. Mitigation requires upgrading to patch level 2025.1.3 or disabling the mobile application in Microsoft IIS.